Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-96609: Robur Albatross console can hang when logs fill buffer
CVE-2026-96609 · published 1 month ago
Summary
Robur Albatross versions 1.0.0 through 2.x before 2.7.2 allow the internal log buffer to fill without stopping the console loop. If an authorized user sends many console commands that generate lots of log messages, the console can become unresponsive. Update to version 2.7.2 or later to fix the problem.
What to do
- Update robur albatross to version 2.7.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| robur | albatross | < 2.7.2 |
Original advisory text
Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by user...
Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fill the ring buffer (1024 lines). It is not exploitable by unauthorized clients.
References
- https://github.com/robur-coop/albatross/pull/273 Patch
- https://osv.dev/vulnerability/OSEC-2026-09 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96609... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-96609 Vendor Advisory
- https://github.com/robur-coop/albatross Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published23 Sep 2026
Updated4 Nov 2026
First seen23 Sep 2026
Track software like this
Free during beta